Trojan.Encoder.35287

Technical Information

To ensure autorun and distribution

Creates the following files on removable media

<Drive name for removable media>:\readme.txt

Malicious functions

Executes the following

'%WINDIR%\syswow64\net.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\net.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\net.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\net.exe' stop SQLWriter /y

Modifies file system

Creates the following files

C:\readme.txt
%ProgramFiles%\quaranti\readme.txt
%ProgramFiles%\quickstart\readme.txt
%ProgramFiles%\ragexe\readme.txt
%ProgramFiles%\ragfree\readme.txt
%ProgramFiles%\rapget\readme.txt
%ProgramFiles%\rat\readme.txt
%ProgramFiles%\ravmon\readme.txt
%ProgramFiles%\rtvscan\readme.txt
%ProgramFiles%\qrtfix\readme.txt
%ProgramFiles%\qklez\readme.txt
%ProgramFiles%\reference assemblies\readme.txt
%ProgramFiles%\register\readme.txt
%ProgramFiles%\removeit\readme.txt
%ProgramFiles%\remover\readme.txt
%ProgramFiles%\rescue\readme.txt
%ProgramFiles%\rfwmain\readme.txt
%ProgramFiles%\rq\readme.txt
%ProgramFiles%\ravtimer\readme.txt
%ProgramFiles%\realmon\readme.txt
%ProgramFiles%\start_diag\readme.txt
%ProgramFiles%\rcimlby\readme.txt
%ProgramFiles%\psctrls\readme.txt
%ProgramFiles%\preconfig\readme.txt
%ProgramFiles%\preupd\readme.txt
%ProgramFiles%\prevsrv\readme.txt
%ProgramFiles%\prevxsetup\readme.txt
%ProgramFiles%\privatebrowser\readme.txt
%ProgramFiles%\processviewer\readme.txt
%ProgramFiles%\protect\readme.txt
%ProgramFiles%\python\readme.txt
%ProgramFiles%\qip\readme.txt
%ProgramFiles%\qhwscsvc\readme.txt
%ProgramFiles%\psimsvc\readme.txt
%ProgramFiles%\pxagent\readme.txt
%ProgramFiles%\pxconsole\readme.txt
%ProgramFiles%\pxl\readme.txt
%ProgramFiles%\pxl1\readme.txt
%ProgramFiles%\pxreset\readme.txt
%ProgramFiles%\pxsupport\readme.txt
%ProgramFiles%\ps\readme.txt
%ProgramFiles%\pshost\readme.txt
%ProgramFiles%\pqpent\readme.txt
%ProgramFiles%\pqpe9x\readme.txt
%ProgramFiles%\sarcli\readme.txt
%ProgramFiles%\skypepm\readme.txt
%ProgramFiles%\smartftp\readme.txt
%ProgramFiles%\smath\readme.txt
%ProgramFiles%\smc\readme.txt
%ProgramFiles%\sndsrvc\readme.txt
%ProgramFiles%\sniffer\readme.txt
%ProgramFiles%\so3d\readme.txt
%ProgramFiles%\runsetup\readme.txt
%ProgramFiles%\skype\readme.txt
%ProgramFiles%\sitecli\readme.txt
%ProgramFiles%\spider\readme.txt
%ProgramFiles%\spiderml\readme.txt
%ProgramFiles%\spidernt\readme.txt
%ProgramFiles%\spiderui\readme.txt
%ProgramFiles%\sporder\readme.txt
%ProgramFiles%\spybotsd\readme.txt
%ProgramFiles%\sro_client\readme.txt
%ProgramFiles%\soffice\readme.txt
%ProgramFiles%\spbbcsvc\readme.txt
%ProgramFiles%\safari\readme.txt
%ProgramFiles%\spamcfg\readme.txt
%ProgramFiles%\rulaunch\readme.txt
%ProgramFiles%\sargui\readme.txt
%ProgramFiles%\savadminservice\readme.txt
%ProgramFiles%\savmain\readme.txt
%ProgramFiles%\savprogress\readme.txt
%ProgramFiles%\savscan\readme.txt
%ProgramFiles%\sbase\readme.txt
%ProgramFiles%\scalc\readme.txt
%ProgramFiles%\sfagent\readme.txt
%ProgramFiles%\simpress\readme.txt
%ProgramFiles%\sigtool\readme.txt
%ProgramFiles%\sdhelp\readme.txt
%ProgramFiles%\sdinvoker\readme.txt
%ProgramFiles%\sdloader\readme.txt
%ProgramFiles%\sdraw\readme.txt
%ProgramFiles%\sdtrayapp\readme.txt
%ProgramFiles%\seamonkey\readme.txt
%ProgramFiles%\seccenter\readme.txt
%ProgramFiles%\scanner\readme.txt
%ProgramFiles%\sched\readme.txt
%ProgramFiles%\miranda32\readme.txt
%ProgramFiles%\scanningprocess\readme.txt
%ProgramFiles%\onaccessinstaller\readme.txt
%ProgramFiles%\navwnt\readme.txt
%ProgramFiles%\neowatchlog\readme.txt
%ProgramFiles%\neowatchtray\readme.txt
%ProgramFiles%\netstatviewer\readme.txt
%ProgramFiles%\netxray\readme.txt
%ProgramFiles%\nisoptui\readme.txt
%ProgramFiles%\nod\readme.txt
%ProgramFiles%\ntoskrnl\readme.txt
%ProgramFiles%\navw32\readme.txt
%ProgramFiles%\navstub\readme.txt
%ProgramFiles%\notifyha\readme.txt
%ProgramFiles%\notstart\readme.txt
%ProgramFiles%\npavtray\readme.txt
%ProgramFiles%\npfmsg\readme.txt
%ProgramFiles%\nsmdtr\readme.txt
%ProgramFiles%\nssserv\readme.txt
%ProgramFiles%\nsstray\readme.txt
%ProgramFiles%\nod32\readme.txt
%ProgramFiles%\nod32kui\readme.txt
%ProgramFiles%\ppfw\readme.txt
%ProgramFiles%\nod32krn\readme.txt
%ProgramFiles%\mpssvc\readme.txt
%ProgramFiles%\monlite\readme.txt
%ProgramFiles%\monsysnt\readme.txt
%ProgramFiles%\mp3theater\readme.txt
%ProgramFiles%\mp3toys\readme.txt
%ProgramFiles%\mp3toystray\readme.txt
%ProgramFiles%\mp3tray\readme.txt
%ProgramFiles%\mpeng\readme.txt
%ProgramFiles%\myagttry\readme.txt
%ProgramFiles%\navlu32\readme.txt
%ProgramFiles%\navapsvc\readme.txt
%ProgramFiles%\msimn\readme.txt
%ProgramFiles%\msmpsvc\readme.txt
%ProgramFiles%\msn6\readme.txt
%ProgramFiles%\msnmsgr\readme.txt
%ProgramFiles%\mva\readme.txt
%ProgramFiles%\mvc\readme.txt
%ProgramFiles%\myagtsvc\readme.txt
%ProgramFiles%\mpftray\readme.txt
%ProgramFiles%\msbuild\readme.txt
%ProgramFiles%\pqpe\readme.txt
%ProgramFiles%\pqbw\readme.txt
%ProgramFiles%\nvcod\readme.txt
%ProgramFiles%\pavprsrv\readme.txt
%ProgramFiles%\pavsrv51\readme.txt
%ProgramFiles%\pccguide\readme.txt
%ProgramFiles%\pccntmon\readme.txt
%ProgramFiles%\pccpfw\readme.txt
%ProgramFiles%\pcctlcom\readme.txt
%ProgramFiles%\pctav\readme.txt
%ProgramFiles%\ntxconfig\readme.txt
%ProgramFiles%\pavproxy\readme.txt
%ProgramFiles%\pavprot\readme.txt
%ProgramFiles%\pm8flash\readme.txt
%ProgramFiles%\pmagic\readme.txt
%ProgramFiles%\pmagic9x\readme.txt
%ProgramFiles%\pmagicbt\readme.txt
%ProgramFiles%\pmagicnt\readme.txt
%ProgramFiles%\polutil\readme.txt
%ProgramFiles%\postinstall\readme.txt
%ProgramFiles%\pertsk\readme.txt
%ProgramFiles%\pm\readme.txt
%ProgramFiles%\nupgrade\readme.txt
%ProgramFiles%\pidgin\readme.txt
%ProgramFiles%\ntrtscan\readme.txt
%ProgramFiles%\nvcte\readme.txt
%ProgramFiles%\nvcut\readme.txt
%ProgramFiles%\nwservice\readme.txt
%ProgramFiles%\oasrv\readme.txt
%ProgramFiles%\oaui\readme.txt
%ProgramFiles%\ofcpfwsvc\readme.txt
%ProgramFiles%\oget\readme.txt
%ProgramFiles%\pavfires\readme.txt
%ProgramFiles%\pavkre\readme.txt
%ProgramFiles%\pavfnsvr\readme.txt
%ProgramFiles%\oscheck\readme.txt
%ProgramFiles%\outlook\readme.txt
%ProgramFiles%\outpost\readme.txt
%ProgramFiles%\partin\readme.txt
%ProgramFiles%\partin9x\readme.txt
%ProgramFiles%\partinfo\readme.txt
%ProgramFiles%\partinnt\readme.txt
%ProgramFiles%\oladdin\readme.txt
%ProgramFiles%\opera\readme.txt
%ProgramFiles%\miro\readme.txt
%ProgramFiles%\stopsignav\readme.txt
%ProgramFiles%\swagent\readme.txt
%ProgramFiles(x86)%\k-lite codec pack\readme.txt
%ProgramFiles(x86)%\microsoft analysis services\readme.txt
%ProgramFiles(x86)%\microsoft office\readme.txt
%ProgramFiles(x86)%\microsoft visual studio .net 2003\readme.txt
%ProgramFiles(x86)%\microsoft visual studio 8\readme.txt
%ProgramFiles(x86)%\microsoft.net\readme.txt
%ProgramFiles(x86)%\mozilla firefox\readme.txt
%ALLUSERSPROFILE%\application data\readme.txt
%ProgramFiles(x86)%\internet explorer\readme.txt
%ProgramFiles(x86)%\google\readme.txt
%ProgramFiles(x86)%\pidgin\readme.txt
%ProgramFiles(x86)%\qip 2012\readme.txt
%ProgramFiles(x86)%\reference assemblies\readme.txt
%ProgramFiles(x86)%\steam\readme.txt
%ProgramFiles(x86)%\uninstall information\readme.txt
%ProgramFiles(x86)%\winamp\readme.txt
%ALLUSERSPROFILE%\adobe\readme.txt
%ProgramFiles(x86)%\mozilla thunderbird\readme.txt
%ProgramFiles(x86)%\opera\readme.txt
%ProgramFiles%\wlmail\readme.txt
%ProgramFiles(x86)%\msbuild\readme.txt
%ProgramFiles%\xcommsvr\readme.txt
%ProgramFiles%\woool\readme.txt
%ProgramFiles%\wow\readme.txt
%ProgramFiles%\wradmin\readme.txt
%ProgramFiles%\wrctrl\readme.txt
%ProgramFiles%\writespid\readme.txt
%ProgramFiles%\wsctool\readme.txt
%ProgramFiles%\wsftpgui\readme.txt
%ProgramFiles%\zonealarm\readme.txt
%CommonProgramFiles(x86)%\readme.txt
%ProgramFiles(x86)%\adobe\readme.txt
%ProgramFiles%\yahoosync\readme.txt
%ProgramFiles%\ybclient\readme.txt
%ProgramFiles%\ymsgr_tray\readme.txt
%ProgramFiles%\zapro\readme.txt
%ProgramFiles%\zatutor\readme.txt
%ProgramFiles%\zauninst\readme.txt
%ProgramFiles%\zlclient\readme.txt
%ProgramFiles%\wsm\readme.txt
%ProgramFiles%\yahoomessenger\readme.txt
%ProgramFiles%\wltuser\readme.txt
%ALLUSERSPROFILE%\desktop\readme.txt
%ALLUSERSPROFILE%\microsoft help\readme.txt
C:\far2\plugins\arclite\readme.txt
C:\far2\plugins\autowrap\readme.txt
C:\far2\plugins\brackets\readme.txt
C:\far2\plugins\compare\readme.txt
C:\far2\plugins\drawline\readme.txt
C:\far2\plugins\editcase\readme.txt
C:\far2\plugins\emenu\readme.txt
C:\far2\encyclopedia\tap\readme.txt
C:\far2\plugins\align\readme.txt
C:\far2\plugins\farcmds\readme.txt
C:\far2\plugins\hlfviewer\readme.txt
C:\far2\plugins\macroview\readme.txt
C:\far2\plugins\network\readme.txt
C:\far2\plugins\proclist\readme.txt
C:\far2\pluginsdk\headers.c\readme.txt
C:\far2\pluginsdk\headers.pas\readme.txt
C:\msocache\all users\{90140000-0011-0000-1000-0000000ff1ce}-c\readme.txt
C:\far2\plugins\filecase\readme.txt
C:\far2\plugins\ftp\readme.txt
%ALLUSERSPROFILE%\favorites\readme.txt
%ALLUSERSPROFILE%\documents\readme.txt
C:\far2\addons\xlat\readme.txt
%ALLUSERSPROFILE%\microsoft toolkit\readme.txt
%ALLUSERSPROFILE%\mozilla\readme.txt
%ALLUSERSPROFILE%\oracle\readme.txt
%ALLUSERSPROFILE%\package cache\readme.txt
%ALLUSERSPROFILE%\start menu\readme.txt
%ALLUSERSPROFILE%\sun\readme.txt
C:\far2\documentation\eng\readme.txt
%ALLUSERSPROFILE%\microsoft\readme.txt
C:\far2\documentation\rus\readme.txt
C:\recovery\1195d5a8-f371-11e4-9c00-dd3082671db2\readme.txt
C:\users\public\readme.txt
%HOMEPATH%\readme.txt
C:\far2\addons\colors\readme.txt
C:\far2\addons\macros\readme.txt
C:\far2\addons\setup\readme.txt
C:\far2\addons\shell\readme.txt
C:\totalcmd\language\readme.txt
C:\users\default\readme.txt
C:\users\default user\readme.txt
%ProgramFiles%\submitfiles\readme.txt
%ProgramFiles%\streetsolkshim\readme.txt
%ProgramFiles%\winssnotify\readme.txt
%ProgramFiles%\tracelog\readme.txt
%ProgramFiles%\traymon\readme.txt
%ProgramFiles%\trillian\readme.txt
%ProgramFiles%\trojanguarder\readme.txt
%ProgramFiles%\trojanhunter\readme.txt
%ProgramFiles%\trtddptr\readme.txt
%ProgramFiles%\tmntsrv\readme.txt
%ProgramFiles%\tmlisten\readme.txt
%ProgramFiles%\totalcmd\readme.txt
%ProgramFiles%\twelvesky2\readme.txt
%ProgramFiles%\uninstallcavs\readme.txt
%ProgramFiles%\uninstaller\readme.txt
%ProgramFiles%\uninstalllsp\readme.txt
%ProgramFiles%\unoinfo\readme.txt
%ProgramFiles%\unopkg\readme.txt
%ProgramFiles%\unp_test\readme.txt
%ProgramFiles%\uiscan\readme.txt
%ProgramFiles%\una\readme.txt
%ProgramFiles%\uninstall information\readme.txt
%ProgramFiles%\tnbutil\readme.txt
%ProgramFiles%\up2date\readme.txt
%ProgramFiles%\wish\readme.txt
%ProgramFiles%\swdoctor\readme.txt
%ProgramFiles%\swdsvc\readme.txt
%ProgramFiles%\sweb\readme.txt
%ProgramFiles%\swriter\readme.txt
%ProgramFiles%\symantecrootinstaller\readme.txt
%ProgramFiles%\symlcsvc\readme.txt
%ProgramFiles%\tmas\readme.txt
%ProgramFiles%\svcntaux\readme.txt
%ProgramFiles%\thunderbird\readme.txt
%ProgramFiles%\symproxysvc\readme.txt
%ProgramFiles%\tbmon\readme.txt
%ProgramFiles%\tca\readme.txt
%ProgramFiles%\teatimer\readme.txt
%ProgramFiles%\tgsvcstp\readme.txt
%ProgramFiles%\thebat\readme.txt
%ProgramFiles%\thgnard\readme.txt
%ProgramFiles%\symsport\readme.txt
%ProgramFiles%\symwsc\readme.txt
%ProgramFiles%\sysinfo\readme.txt
%ProgramFiles%\wlloginproxy\readme.txt
%ProgramFiles%\updater\readme.txt
%ProgramFiles%\upsobmaker\readme.txt
%ProgramFiles%\vsserv\readme.txt
%ProgramFiles%\vsstat\readme.txt
%ProgramFiles%\wclose\readme.txt
%ProgramFiles%\webfiltr\readme.txt
%ProgramFiles%\webmoney\readme.txt
%ProgramFiles%\webproxy\readme.txt
%ProgramFiles%\vrrw32\readme.txt
%ProgramFiles%\vrmonsvc\readme.txt
%ProgramFiles%\vsmon\readme.txt
%ProgramFiles%\webscanx\readme.txt
%ProgramFiles%\wincmd32\readme.txt
%ProgramFiles%\windowlist\readme.txt
%ProgramFiles%\windump\readme.txt
%ProgramFiles%\winmail\readme.txt
%ProgramFiles%\winroute\readme.txt
%ProgramFiles%\winss\readme.txt
%ProgramFiles%\wil\readme.txt
%ProgramFiles%\winaw32\readme.txt
%ProgramFiles%\winbaram\readme.txt
%ProgramFiles%\vshwin32\readme.txt
%ProgramFiles%\updaterui\readme.txt
%ProgramFiles%\updclient\readme.txt
%ProgramFiles%\usdownloader\readme.txt
%ProgramFiles%\uupd\readme.txt
%ProgramFiles%\vba32ecm\readme.txt
%ProgramFiles%\vba32ifs\readme.txt
%ProgramFiles%\vba32ldr\readme.txt
%ProgramFiles%\vba32pp3\readme.txt
%ProgramFiles%\vrfwsvc\readme.txt
%ProgramFiles%\upgrepl\readme.txt
%ProgramFiles%\visthupd\readme.txt
%ProgramFiles%\vbsntw\readme.txt
%ProgramFiles%\viritexp\readme.txt
%ProgramFiles%\viritsvc\readme.txt
%ProgramFiles%\viruskeeper\readme.txt
%ProgramFiles%\virusnews\readme.txt
%ProgramFiles%\vistaux\readme.txt
%ProgramFiles%\visthlic\readme.txt
%ProgramFiles%\vchk\readme.txt
%ProgramFiles%\vcrmon\readme.txt
%ProgramFiles%\vettray\readme.txt
%ProgramFiles%\mir3game\readme.txt
%ProgramFiles%\microsoft synchronization services\readme.txt
%ProgramFiles%\microsoft sync framework\readme.txt
%ProgramFiles%\blackd\readme.txt
%ProgramFiles%\blackice\readme.txt
%ProgramFiles%\blindman\readme.txt
%ProgramFiles%\btini\readme.txt
%ProgramFiles%\btinint\readme.txt
%ProgramFiles%\cabalmain\readme.txt
%ProgramFiles%\cafix\readme.txt
%ProgramFiles%\bdswitch\readme.txt
%ProgramFiles%\cavsn\readme.txt
%ProgramFiles%\bdsurvey\readme.txt
%ProgramFiles%\cavemsrv\readme.txt
%ProgramFiles%\cavmr\readme.txt
%ProgramFiles%\cavmud\readme.txt
%ProgramFiles%\cavoar\readme.txt
%ProgramFiles%\cavq\readme.txt
%ProgramFiles%\cavscons\readme.txt
%ProgramFiles%\cavse\readme.txt
%ProgramFiles%\cavasm\readme.txt
%ProgramFiles%\cavapp\readme.txt
%ProgramFiles%\cavaud\readme.txt
%ProgramFiles%\bdsubmit\readme.txt
%ProgramFiles%\avsynmgr\readme.txt
%ProgramFiles%\avgwizfw\readme.txt
%ProgramFiles%\avinitnt\readme.txt
%ProgramFiles%\avkserv\readme.txt
%ProgramFiles%\avkservice\readme.txt
%ProgramFiles%\avkwctl\readme.txt
%ProgramFiles%\avnotify\readme.txt
%ProgramFiles%\avpcc\readme.txt
%ProgramFiles%\bdsubmitwiz\readme.txt
%ProgramFiles%\avgvv\readme.txt
%ProgramFiles%\avgw\readme.txt
%ProgramFiles%\b2\readme.txt
%ProgramFiles%\backweb-4476822\readme.txt
%ProgramFiles%\bdagent\readme.txt
%ProgramFiles%\bdmcon\readme.txt
%ProgramFiles%\bdnews\readme.txt
%ProgramFiles%\bdoesrv\readme.txt
%ProgramFiles%\bdss\readme.txt
%ProgramFiles%\avscan\readme.txt
%ProgramFiles%\avpm\readme.txt
%ProgramFiles%\drvctl\readme.txt
%ProgramFiles%\avgupsvc\readme.txt
%ProgramFiles%\courier\readme.txt
%ProgramFiles%\cpd\readme.txt
%ProgramFiles%\csendto\readme.txt
%ProgramFiles%\cssexc\readme.txt
%ProgramFiles%\custinstall\readme.txt
%ProgramFiles%\custsetup\readme.txt
%ProgramFiles%\cuteftp\readme.txt
%ProgramFiles%\dbconvert\readme.txt
%ProgramFiles%\copyx64\readme.txt
%ProgramFiles%\cavsubmit\readme.txt
%CommonProgramFiles%\readme.txt
%ProgramFiles%\dekaron\readme.txt
%ProgramFiles%\digsby\readme.txt
%ProgramFiles%\digsby-app\readme.txt
%ProgramFiles%\directftp\readme.txt
%ProgramFiles%\dislite\readme.txt
%ProgramFiles%\dnf\readme.txt
%ProgramFiles%\dpatrolq\readme.txt
%ProgramFiles%\defensewall\readme.txt
%ProgramFiles%\dbtool\readme.txt
%ProgramFiles%\cavsub\readme.txt
%ProgramFiles%\cmain\readme.txt
%ProgramFiles%\clamtray\readme.txt
%ProgramFiles%\cavvl\readme.txt
%ProgramFiles%\ccapp\readme.txt
%ProgramFiles%\ccevtmgr\readme.txt
%ProgramFiles%\ccleaner\readme.txt
%ProgramFiles%\ccproxy\readme.txt
%ProgramFiles%\ccsetmgr\readme.txt
%ProgramFiles%\cemrep\readme.txt
%ProgramFiles%\cmgrdian\readme.txt
%ProgramFiles%\cavumas\readme.txt
%ProgramFiles%\cavuserupd\readme.txt
%ProgramFiles%\clamwin\readme.txt
%ProgramFiles%\claw95\readme.txt
%ProgramFiles%\claw95cf\readme.txt
%ProgramFiles%\cleaner\readme.txt
%ProgramFiles%\cleaner3\readme.txt
%ProgramFiles%\clisvc\readme.txt
%ProgramFiles%\clrcche\readme.txt
%ProgramFiles%\clamscan\readme.txt
%ProgramFiles%\chrome\readme.txt
%ProgramFiles%\defwatch\readme.txt
%ProgramFiles%\avgscan\readme.txt
%ProgramFiles%\avgcc\readme.txt
%ProgramFiles%\a2upd\readme.txt
%ProgramFiles%\a2wizard\readme.txt
%ProgramFiles%\aavshield\readme.txt
D:\readme.txt
%ProgramFiles%\about\readme.txt
%ProgramFiles%\ackwin32\readme.txt
%ProgramFiles%\admunch\readme.txt
%ProgramFiles%\a2service\readme.txt
%ProgramFiles%\anti-trojan\readme.txt
%ProgramFiles%\a2scan\readme.txt
%ProgramFiles%\aim6\readme.txt
%ProgramFiles%\aimpro\readme.txt
%ProgramFiles%\airdefense\readme.txt
%ProgramFiles%\almon\readme.txt
%ProgramFiles%\alsvc\readme.txt
%ProgramFiles%\amon\readme.txt
%ProgramFiles%\amsn\readme.txt
%ProgramFiles%\ageofconan\readme.txt
%ProgramFiles%\agb5\readme.txt
%ProgramFiles%\ahnsd\readme.txt
%ProgramFiles%\a2guard\readme.txt
C:\far2\documentation\readme.txt
C:\far2\readme.txt
<Current directory>\readme.txt
C:\msocache\readme.txt
%ProgramFiles%\readme.txt
%ProgramFiles(x86)%\readme.txt
%ALLUSERSPROFILE%\readme.txt
C:\recovery\readme.txt
%ProgramFiles%\a2hijackfree\readme.txt
%ProgramFiles%\avgupden\readme.txt
C:\documents and settings\readme.txt
C:\far2\encyclopedia\readme.txt
C:\far2\fexcept\readme.txt
C:\far2\plugins\readme.txt
C:\far2\pluginsdk\readme.txt
C:\msocache\all users\readme.txt
%ProgramFiles%\360tray\readme.txt
%ProgramFiles%\a2cmd\readme.txt
C:\users\readme.txt
C:\totalcmd\readme.txt
%ProgramFiles%\drvirus\readme.txt
%ProgramFiles%\a2start\readme.txt
%ProgramFiles%\autodown\readme.txt
%ProgramFiles%\autostartexplorer\readme.txt
%ProgramFiles%\autotrace\readme.txt
%ProgramFiles%\avadmin\readme.txt
%ProgramFiles%\avcenter\readme.txt
%ProgramFiles%\avciman\readme.txt
%ProgramFiles%\avcmd\readme.txt
%ProgramFiles%\avconfig\readme.txt
%ProgramFiles%\aswupdsv\readme.txt
%ProgramFiles%\aoltbserver\readme.txt
%ProgramFiles%\aswregsvr\readme.txt
%ProgramFiles%\avgdiag\readme.txt
%ProgramFiles%\avgemc\readme.txt
%ProgramFiles%\avgfwsrv\readme.txt
%ProgramFiles%\avginet\readme.txt
%ProgramFiles%\avgnpdln\readme.txt
%ProgramFiles%\avgnpsvc\readme.txt
%ProgramFiles%\avgrssvc\readme.txt
%ProgramFiles%\avgamsvr\readme.txt
%ProgramFiles%\avconsol\readme.txt
%ProgramFiles%\antivirus\readme.txt
%ProgramFiles%\ashwebsv\readme.txt
%ProgramFiles%\ashpopwz\readme.txt
%ProgramFiles%\ash\readme.txt
%ProgramFiles%\ashavast\readme.txt
%ProgramFiles%\ashavsrv\readme.txt
%ProgramFiles%\ashchest\readme.txt
%ProgramFiles%\ashdisp\readme.txt
%ProgramFiles%\ashdug\readme.txt
%ProgramFiles%\ashenhcd\readme.txt
%ProgramFiles%\ash_updatemediator\readme.txt
%ProgramFiles%\armor2net\readme.txt
%ProgramFiles%\armorsurf\readme.txt
%ProgramFiles%\ashquick\readme.txt
%ProgramFiles%\ashserv\readme.txt
%ProgramFiles%\ashsimp2\readme.txt
%ProgramFiles%\ashsimpl\readme.txt
%ProgramFiles%\ashskpcc\readme.txt
%ProgramFiles%\ashskpck\readme.txt
%ProgramFiles%\ashupd\readme.txt
%ProgramFiles%\ashmaisv\readme.txt
%ProgramFiles%\ashlogv\readme.txt
%ProgramFiles%\bdwizreg\readme.txt
%ProgramFiles%\drvmap\readme.txt
%ProgramFiles%\ih8\readme.txt
%ProgramFiles%\ilaunchr\readme.txt
%ProgramFiles%\imapp\readme.txt
%ProgramFiles%\imnotfy\readme.txt
%ProgramFiles%\impcnt\readme.txt
%ProgramFiles%\incmail\readme.txt
%ProgramFiles%\inocit\readme.txt
%ProgramFiles%\iexplore\readme.txt
%ProgramFiles%\ieuser\readme.txt
%ProgramFiles%\ih8run\readme.txt
%ProgramFiles%\inorpc\readme.txt
%ProgramFiles%\inphasenxd\readme.txt
%ProgramFiles%\installcavs\readme.txt
%ProgramFiles%\installlicense\readme.txt
%ProgramFiles%\installlsp\readme.txt
%ProgramFiles%\instlsp\readme.txt
%ProgramFiles%\internet explorer\readme.txt
%ProgramFiles%\inort\readme.txt
%ProgramFiles%\inotask\readme.txt
%ProgramFiles%\inouptng\readme.txt
%ProgramFiles%\ge\readme.txt
%ProgramFiles%\iris\readme.txt
%ProgramFiles%\giantantispywaremain\readme.txt
%ProgramFiles%\googledesktop\readme.txt
%ProgramFiles%\googletalk\readme.txt
%ProgramFiles%\googleupdate\readme.txt
%ProgramFiles%\guardgni\readme.txt
%ProgramFiles%\guardnt\readme.txt
%ProgramFiles%\gw\readme.txt
%ProgramFiles%\ieregfix\readme.txt
%ProgramFiles%\giantantispywareupdater\readme.txt
%ProgramFiles%\icqlite\readme.txt
%ProgramFiles%\helpctr\readme.txt
%ProgramFiles%\hrres\readme.txt
%ProgramFiles%\hsockpe\readme.txt
%ProgramFiles%\httplook\readme.txt
%ProgramFiles%\iamapp\readme.txt
%ProgramFiles%\iamserv\readme.txt
%ProgramFiles%\icq\readme.txt
%ProgramFiles%\helper\readme.txt
%ProgramFiles%\hipsdiag\readme.txt
%ProgramFiles%\hregmon\readme.txt
%ProgramFiles%\gnotify\readme.txt
%ProgramFiles%\iron\readme.txt
%ProgramFiles%\issvc\readme.txt
%ProgramFiles%\luna\readme.txt
%ProgramFiles%\luupdate\readme.txt
%ProgramFiles%\magent\readme.txt
%ProgramFiles%\malwareremoval\readme.txt
%ProgramFiles%\maplestory\readme.txt
%ProgramFiles%\maxthon\readme.txt
%ProgramFiles%\lucheck\readme.txt
%ProgramFiles%\lucallbackproxy\readme.txt
%ProgramFiles%\luinit\readme.txt
%ProgramFiles%\mcmnhdlr\readme.txt
%ProgramFiles%\mcvsshld\readme.txt
%ProgramFiles%\memstring\readme.txt
%ProgramFiles%\mfpmp\readme.txt
%ProgramFiles%\microsoft analysis services\readme.txt
%ProgramFiles%\microsoft office\readme.txt
%ProgramFiles%\microsoft sql server compact edition\readme.txt
%ProgramFiles%\mcregwiz\readme.txt
%ProgramFiles%\mcshield\readme.txt
%ProgramFiles%\mcupdmgr\readme.txt
%ProgramFiles%\luconfig\readme.txt
%ProgramFiles%\isafe\readme.txt
%ProgramFiles%\ispnews\readme.txt
%ProgramFiles%\isuac\readme.txt
%ProgramFiles%\itunes\readme.txt
%ProgramFiles%\java\readme.txt
%ProgramFiles%\k-meleon\readme.txt
%ProgramFiles%\kav\readme.txt
%ProgramFiles%\kavmm\readme.txt
%ProgramFiles%\lpfw\readme.txt
%ProgramFiles%\ispwdsvc\readme.txt
%ProgramFiles%\lotroclient\readme.txt
%ProgramFiles%\kavpf\readme.txt
%ProgramFiles%\konnekt\readme.txt
%ProgramFiles%\launcher\readme.txt
%ProgramFiles%\licmgr\readme.txt
%ProgramFiles%\livesrv\readme.txt
%ProgramFiles%\liveupdate\readme.txt
%ProgramFiles%\logwatnt\readme.txt
%ProgramFiles%\kavpfw\readme.txt
%ProgramFiles%\kavstart\readme.txt
%ProgramFiles%\kavsvc\readme.txt
%ProgramFiles%\gg\readme.txt
%ProgramFiles%\gcasserv\readme.txt
%ProgramFiles%\drwadins\readme.txt
%ProgramFiles%\fdmwi\readme.txt
%ProgramFiles%\filezilla\readme.txt
%ProgramFiles%\firebird\readme.txt
%ProgramFiles%\firesvc\readme.txt
%ProgramFiles%\firetray\readme.txt
%ProgramFiles%\flashfxp\readme.txt
%ProgramFiles%\flashgot\readme.txt
%ProgramFiles%\fch32\readme.txt
%ProgramFiles%\fsaua\readme.txt
%ProgramFiles%\far\readme.txt
%ProgramFiles%\fpavupdm\readme.txt
%ProgramFiles%\fprottray\readme.txt
%ProgramFiles%\fpscan\readme.txt
%ProgramFiles%\fptrayproc\readme.txt
%ProgramFiles%\fpwin\readme.txt
%ProgramFiles%\freshclam\readme.txt
%ProgramFiles%\fsample\readme.txt
%ProgramFiles%\foxit\readme.txt
%ProgramFiles%\flock\readme.txt
%ProgramFiles%\fpavserver\readme.txt
%ProgramFiles%\f-sched\readme.txt
%ProgramFiles%\ehsniffer\readme.txt
%ProgramFiles%\drweb32w\readme.txt
%ProgramFiles%\drweb386\readme.txt
%ProgramFiles%\drwebscd\readme.txt
%ProgramFiles%\drwebupw\readme.txt
%ProgramFiles%\drwebwcl\readme.txt
%ProgramFiles%\drwreg\readme.txt
%ProgramFiles%\dvd maker\readme.txt
%ProgramFiles%\fameh32\readme.txt
%ProgramFiles%\fsauach\readme.txt
%ProgramFiles%\drweb\readme.txt
%ProgramFiles%\ekrn\readme.txt
%ProgramFiles%\elementclient\readme.txt
%ProgramFiles%\etherd\readme.txt
%ProgramFiles%\eudora\readme.txt
%ProgramFiles%\ewidoctrl\readme.txt
%ProgramFiles%\exit_av\readme.txt
%ProgramFiles%\ezantivirusregistrationcheck\readme.txt
%ProgramFiles%\egni\readme.txt
%ProgramFiles%\ecmd\readme.txt
%ProgramFiles%\fdm\readme.txt
%ProgramFiles%\fsav\readme.txt
%ProgramFiles%\fslaunch\readme.txt
%ProgramFiles%\fsma32\readme.txt
%ProgramFiles%\fsmb32\readme.txt
%ProgramFiles%\fspc\readme.txt
%ProgramFiles%\fspex\readme.txt
%ProgramFiles%\fsqh\readme.txt
%ProgramFiles%\fssf\readme.txt
%ProgramFiles%\fsihs\readme.txt
%ProgramFiles%\fshotfix\readme.txt
%ProgramFiles%\fsm32\readme.txt
%ProgramFiles%\fssg\readme.txt
%ProgramFiles%\fstlui\readme.txt
%ProgramFiles%\fsuninst\readme.txt
%ProgramFiles%\fsus\readme.txt
%ProgramFiles%\ftpte\readme.txt
%ProgramFiles%\gc\readme.txt
%ProgramFiles%\gcasdtserv\readme.txt
%ProgramFiles%\fssm32\readme.txt
%ProgramFiles%\fsstm\readme.txt
%ProgramFiles%\fssw\readme.txt
%ProgramFiles%\fsihcomp\readme.txt
%ProgramFiles%\fshelp\readme.txt
%ProgramFiles%\fsav32\readme.txt
%ProgramFiles%\fsavgui\readme.txt
%ProgramFiles%\fsavstrt\readme.txt
%ProgramFiles%\fsavwsch\readme.txt
%ProgramFiles%\fsavwscr\readme.txt
%ProgramFiles%\fsbwsys\readme.txt
%ProgramFiles%\fsdbuh\readme.txt
%ProgramFiles%\fsdc\readme.txt
%ProgramFiles%\fsdfwd\readme.txt
%ProgramFiles%\fsavaui\readme.txt
%ProgramFiles%\fsdiag\readme.txt
%ProgramFiles%\fsfwwsch\readme.txt
%ProgramFiles%\fsfwwscr\readme.txt
%ProgramFiles%\fsgetwab\readme.txt
%ProgramFiles%\fsgk32\readme.txt
%ProgramFiles%\fsgk32st\readme.txt
%ProgramFiles%\fsguidll\readme.txt
%ProgramFiles%\fsguiexe\readme.txt
%ProgramFiles%\fshdll32\readme.txt
%ProgramFiles%\fsdiagui\readme.txt
C:\msocache\all users\{90140000-0016-0409-1000-0000000ff1ce}-c\readme.txt
C:\msocache\all users\{90140000-0018-0409-1000-0000000ff1ce}-c\readme.txt

Moves the following files

from %ProgramFiles%\firefox\blocklist.xml to %ProgramFiles%\firefox\blocklist.xml.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\install.log to %ProgramFiles(x86)%\mozilla firefox\install.log.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk to %ProgramFiles(x86)%\mozilla firefox\nssdbm3.chk.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\omni.ja to %ProgramFiles(x86)%\mozilla firefox\omni.ja.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\precomplete to %ProgramFiles(x86)%\mozilla firefox\precomplete.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\removed-files to %ProgramFiles(x86)%\mozilla firefox\removed-files.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\softokn3.chk to %ProgramFiles(x86)%\mozilla firefox\softokn3.chk.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\voucher.bin to %ProgramFiles(x86)%\mozilla firefox\voucher.bin.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list to %ProgramFiles(x86)%\mozilla thunderbird\dependentlibs.list.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk to %ProgramFiles(x86)%\mozilla thunderbird\freebl3.chk.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list to %ProgramFiles(x86)%\mozilla firefox\dependentlibs.list.iiwoo
from %ProgramFiles(x86)%\mozilla firefox\freebl3.chk to %ProgramFiles(x86)%\mozilla firefox\freebl3.chk.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\install.log to %ProgramFiles(x86)%\mozilla thunderbird\install.log.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\precomplete to %ProgramFiles(x86)%\mozilla thunderbird\precomplete.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\removed-files to %ProgramFiles(x86)%\mozilla thunderbird\removed-files.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk to %ProgramFiles(x86)%\mozilla thunderbird\softokn3.chk.iiwoo
from %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets to %ProgramFiles(x86)%\msbuild\microsoft.office.infopath.targets.iiwoo
from %ProgramFiles(x86)%\opera\installer_prefs.json to %ProgramFiles(x86)%\opera\installer_prefs.json.iiwoo
from %ProgramFiles(x86)%\opera\resources.pri to %ProgramFiles(x86)%\opera\resources.pri.iiwoo
from %ProgramFiles(x86)%\opera\server_tracking_data to %ProgramFiles(x86)%\opera\server_tracking_data.iiwoo
from %ProgramFiles(x86)%\qip 2012\unins000.msg to %ProgramFiles(x86)%\qip 2012\unins000.msg.iiwoo
from %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css to %ProgramFiles(x86)%\steam\thirdpartylegalnotices.css.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk to %ProgramFiles(x86)%\mozilla thunderbird\nssdbm3.chk.iiwoo
from %ProgramFiles(x86)%\mozilla thunderbird\omni.ja to %ProgramFiles(x86)%\mozilla thunderbird\omni.ja.iiwoo
from %ProgramFiles(x86)%\mirc\versions.txt to %ProgramFiles(x86)%\mirc\versions.txt.iiwoo
from %ProgramFiles(x86)%\mirc\mirc.chm to %ProgramFiles(x86)%\mirc\mirc.chm.iiwoo
from %ProgramFiles(x86)%\mirc\ircintro.chm to %ProgramFiles(x86)%\mirc\ircintro.chm.iiwoo
from %ProgramFiles%\firefox\dependentlibs.list to %ProgramFiles%\firefox\dependentlibs.list.iiwoo
from %ProgramFiles%\firefox\freebl3.chk to %ProgramFiles%\firefox\freebl3.chk.iiwoo
from %ProgramFiles%\firefox\greprefs.js to %ProgramFiles%\firefox\greprefs.js.iiwoo
from %ProgramFiles%\firefox\js.log to %ProgramFiles%\firefox\js.log.iiwoo
from %ProgramFiles%\firefox\nssdbm3.chk to %ProgramFiles%\firefox\nssdbm3.chk.iiwoo
from %ProgramFiles%\firefox\softokn3.chk to %ProgramFiles%\firefox\softokn3.chk.iiwoo
from %ProgramFiles%\firefox\update.locale to %ProgramFiles%\firefox\update.locale.iiwoo
from %ProgramFiles%\foxit\foxit to %ProgramFiles%\foxit\foxit.iiwoo
from %ProgramFiles%\winrar\default.sfx to %ProgramFiles%\winrar\default.sfx.iiwoo
from %ProgramFiles%\winrar\default64.sfx to %ProgramFiles%\winrar\default64.sfx.iiwoo
from %ProgramFiles%\firefox\chrome.manifest to %ProgramFiles%\firefox\chrome.manifest.iiwoo
from %ProgramFiles%\winrar\descript.ion to %ProgramFiles%\winrar\descript.ion.iiwoo
from %ProgramFiles%\winrar\order.htm to %ProgramFiles%\winrar\order.htm.iiwoo
from %ProgramFiles%\winrar\rar.txt to %ProgramFiles%\winrar\rar.txt.iiwoo
from %ProgramFiles%\winrar\rarfiles.lst to %ProgramFiles%\winrar\rarfiles.lst.iiwoo
from %ProgramFiles%\winrar\uninstall.lst to %ProgramFiles%\winrar\uninstall.lst.iiwoo
from %ProgramFiles%\winrar\whatsnew.txt to %ProgramFiles%\winrar\whatsnew.txt.iiwoo
from %ProgramFiles%\winrar\wincon.sfx to %ProgramFiles%\winrar\wincon.sfx.iiwoo
from %ProgramFiles%\winrar\wincon64.sfx to %ProgramFiles%\winrar\wincon64.sfx.iiwoo
from %ProgramFiles%\winrar\winrar.chm to %ProgramFiles%\winrar\winrar.chm.iiwoo
from %ProgramFiles%\winrar\zip.sfx to %ProgramFiles%\winrar\zip.sfx.iiwoo
from %ProgramFiles%\winrar\zip64.sfx to %ProgramFiles%\winrar\zip64.sfx.iiwoo
from %ProgramFiles%\winrar\license.txt to %ProgramFiles%\winrar\license.txt.iiwoo
from %ProgramFiles(x86)%\winamp\pconfig.dcf to %ProgramFiles(x86)%\winamp\pconfig.dcf.iiwoo
from %ProgramFiles(x86)%\winamp\whatsnew.txt to %ProgramFiles(x86)%\winamp\whatsnew.txt.iiwoo

Modifies the following files

C:\far2\changelog
C:\totalcmd\totalcmd.chm
C:\totalcmd\tcuninst.wul
C:\totalcmd\tcunin64.wul
C:\totalcmd\size!.txt
C:\totalcmd\register.rtf
C:\totalcmd\no.bar
C:\totalcmd\keyboard.txt
C:\totalcmd\history.txt
C:\totalcmd\descript.ion
C:\totalcmd\default.bar
%ALLUSERSPROFILE%\ntuser.pol
C:\far2\savesettings.cmd
C:\far2\restoresettings.cmd
C:\far2\file_id.diz
C:\far2\farspa.lng
C:\far2\farrus.lng
C:\far2\farrus.hlf
C:\far2\farpol.lng
C:\far2\farhun.lng
C:\far2\farhun.hlf
C:\far2\farger.lng
C:\far2\fareng.lng
C:\far2\fareng.hlf
C:\far2\farcze.lng
C:\far2\far.map
C:\far2\clearpluginscache.cmd
C:\far2\changelog_eng
C:\totalcmd\totalcmd.inc
C:\totalcmd\wcmicons.inc

Modifies multiple files.

Modifies user data files (Trojan.Encoder).

Changes user data files extensions (Trojan.Encoder).

Network activity

Connects to

'<LOCALNET>.25.0':445
'<LOCALNET>.25.161':445
'<LOCALNET>.25.162':445
'<LOCALNET>.25.163':445
'<LOCALNET>.25.164':445
'<LOCALNET>.25.165':445
'<LOCALNET>.25.166':445
'<LOCALNET>.25.167':445
'<LOCALNET>.25.168':445
'<LOCALNET>.25.169':445
'<LOCALNET>.25.170':445
'<LOCALNET>.25.171':445
'<LOCALNET>.25.172':445
'<LOCALNET>.25.173':445
'<LOCALNET>.25.175':445
'<LOCALNET>.25.189':445
'<LOCALNET>.25.176':445
'<LOCALNET>.25.177':445
'<LOCALNET>.25.178':445
'<LOCALNET>.25.179':445
'<LOCALNET>.25.180':445
'<LOCALNET>.25.181':445
'<LOCALNET>.25.182':445
'<LOCALNET>.25.183':445
'<LOCALNET>.25.184':445
'<LOCALNET>.25.185':445
'<LOCALNET>.25.186':445
'<LOCALNET>.25.187':445
'<LOCALNET>.25.188':445
'<LOCALNET>.25.160':445
'<LOCALNET>.25.174':445
'<LOCALNET>.25.159':445
'<LOCALNET>.25.142':445
'<LOCALNET>.25.129':445
'<LOCALNET>.25.130':445
'<LOCALNET>.25.131':445
'<LOCALNET>.25.132':445
'<LOCALNET>.25.133':445
'<LOCALNET>.25.134':445
'<LOCALNET>.25.135':445
'<LOCALNET>.25.136':445
'<LOCALNET>.25.137':445
'<LOCALNET>.25.138':445
'<LOCALNET>.25.139':445
'<LOCALNET>.25.140':445
'<LOCALNET>.25.141':445
'<LOCALNET>.25.143':445
'<LOCALNET>.25.157':445
'<LOCALNET>.25.144':445
'<LOCALNET>.25.145':445
'<LOCALNET>.25.146':445
'<LOCALNET>.25.147':445
'<LOCALNET>.25.148':445
'<LOCALNET>.25.149':445
'<LOCALNET>.25.150':445
'<LOCALNET>.25.151':445
'<LOCALNET>.25.152':445
'<LOCALNET>.25.153':445
'<LOCALNET>.25.154':445
'<LOCALNET>.25.155':445
'<LOCALNET>.25.156':445
'<LOCALNET>.25.158':445
'<LOCALNET>.25.207':445
'<LOCALNET>.25.253':445
'<LOCALNET>.25.192':445
'<LOCALNET>.25.225':445
'<LOCALNET>.25.226':445
'<LOCALNET>.25.227':445
'<LOCALNET>.25.228':445
'<LOCALNET>.25.229':445
'<LOCALNET>.25.230':445
'<LOCALNET>.25.231':445
'<LOCALNET>.25.232':445
'<LOCALNET>.25.233':445
'<LOCALNET>.25.234':445
'<LOCALNET>.25.235':445
'<LOCALNET>.25.236':445
'<LOCALNET>.25.237':445
'<LOCALNET>.25.239':445
'<LOCALNET>.25.191':445
'<LOCALNET>.25.240':445
'<LOCALNET>.25.241':445
'<LOCALNET>.25.242':445
'<LOCALNET>.25.243':445
'<LOCALNET>.25.244':445
'<LOCALNET>.25.245':445
'<LOCALNET>.25.246':445
'<LOCALNET>.25.247':445
'<LOCALNET>.25.248':445
'<LOCALNET>.25.249':445
'<LOCALNET>.25.250':445
'<LOCALNET>.25.251':445
'<LOCALNET>.25.252':445
'<LOCALNET>.25.224':445
'<LOCALNET>.25.128':445
'<LOCALNET>.25.223':445
'<LOCALNET>.25.206':445
'<LOCALNET>.25.193':445
'<LOCALNET>.25.194':445
'<LOCALNET>.25.195':445
'<LOCALNET>.25.196':445
'<LOCALNET>.25.197':445
'<LOCALNET>.25.198':445
'<LOCALNET>.25.199':445
'<LOCALNET>.25.200':445
'<LOCALNET>.25.201':445
'<LOCALNET>.25.202':445
'<LOCALNET>.25.203':445
'<LOCALNET>.25.204':445
'<LOCALNET>.25.205':445
'<LOCALNET>.25.190':445
'<LOCALNET>.25.221':445
'<LOCALNET>.25.208':445
'<LOCALNET>.25.209':445
'<LOCALNET>.25.210':445
'<LOCALNET>.25.211':445
'<LOCALNET>.25.212':445
'<LOCALNET>.25.213':445
'<LOCALNET>.25.214':445
'<LOCALNET>.25.215':445
'<LOCALNET>.25.216':445
'<LOCALNET>.25.217':445
'<LOCALNET>.25.218':445
'<LOCALNET>.25.219':445
'<LOCALNET>.25.220':445
'<LOCALNET>.25.222':445
'<LOCALNET>.25.238':445
'<LOCALNET>.25.127':445
'<LOCALNET>.25.110':445
'<LOCALNET>.25.33':445
'<LOCALNET>.25.34':445
'<LOCALNET>.25.35':445
'<LOCALNET>.25.36':445
'<LOCALNET>.25.37':445
'<LOCALNET>.25.38':445
'<LOCALNET>.25.39':445
'<LOCALNET>.25.40':445
'<LOCALNET>.25.41':445
'<LOCALNET>.25.42':445
'<LOCALNET>.25.43':445
'<LOCALNET>.25.44':445
'<LOCALNET>.25.45':445
'<LOCALNET>.25.47':445
'<LOCALNET>.25.61':445
'<LOCALNET>.25.48':445
'<LOCALNET>.25.49':445
'<LOCALNET>.25.50':445
'<LOCALNET>.25.51':445
'<LOCALNET>.25.52':445
'<LOCALNET>.25.53':445
'<LOCALNET>.25.54':445
'<LOCALNET>.25.55':445
'<LOCALNET>.25.56':445
'<LOCALNET>.25.57':445
'<LOCALNET>.25.58':445
'<LOCALNET>.25.59':445
'<LOCALNET>.25.60':445
'<LOCALNET>.25.32':445
'<LOCALNET>.25.46':445
'<LOCALNET>.25.31':445
'<LOCALNET>.25.14':445
'<LOCALNET>.25.1':445
'<LOCALNET>.25.2':445
'<LOCALNET>.25.3':445
'<LOCALNET>.25.4':445
'<LOCALNET>.25.5':445
'<LOCALNET>.25.6':445
'<LOCALNET>.25.7':445
'<LOCALNET>.25.8':445
'<LOCALNET>.25.9':445
'<LOCALNET>.25.10':445
'<LOCALNET>.25.11':445
'<LOCALNET>.25.12':445
'<LOCALNET>.25.13':445
'<LOCALNET>.25.15':445
'<LOCALNET>.25.29':445
'<LOCALNET>.25.16':445
'<LOCALNET>.25.17':445
'<LOCALNET>.25.18':445
'<LOCALNET>.25.19':445
'<LOCALNET>.25.20':445
'<LOCALNET>.25.21':445
'<LOCALNET>.25.22':445
'<LOCALNET>.25.23':445
'<LOCALNET>.25.24':445
'<LOCALNET>.25.25':445
'<LOCALNET>.25.26':445
'<LOCALNET>.25.27':445
'<LOCALNET>.25.28':445
'<LOCALNET>.25.30':445
'<LOCALNET>.25.79':445
'<LOCALNET>.25.125':445
'<LOCALNET>.25.64':445
'<LOCALNET>.25.97':445
'<LOCALNET>.25.98':445
'<LOCALNET>.25.99':445
'<LOCALNET>.25.100':445
'<LOCALNET>.25.101':445
'<LOCALNET>.25.102':445
'<LOCALNET>.25.103':445
'<LOCALNET>.25.104':445
'<LOCALNET>.25.105':445
'<LOCALNET>.25.106':445
'<LOCALNET>.25.107':445
'<LOCALNET>.25.108':445
'<LOCALNET>.25.109':445
'<LOCALNET>.25.111':445
'<LOCALNET>.25.63':445
'<LOCALNET>.25.112':445
'<LOCALNET>.25.113':445
'<LOCALNET>.25.114':445
'<LOCALNET>.25.115':445
'<LOCALNET>.25.116':445
'<LOCALNET>.25.117':445
'<LOCALNET>.25.118':445
'<LOCALNET>.25.119':445
'<LOCALNET>.25.120':445
'<LOCALNET>.25.121':445
'<LOCALNET>.25.122':445
'<LOCALNET>.25.123':445
'<LOCALNET>.25.124':445
'<LOCALNET>.25.96':445
'<LOCALNET>.25.126':445
'<LOCALNET>.25.95':445
'<LOCALNET>.25.78':445
'<LOCALNET>.25.65':445
'<LOCALNET>.25.66':445
'<LOCALNET>.25.67':445
'<LOCALNET>.25.68':445
'<LOCALNET>.25.69':445
'<LOCALNET>.25.70':445
'<LOCALNET>.25.71':445
'<LOCALNET>.25.72':445
'<LOCALNET>.25.73':445
'<LOCALNET>.25.74':445
'<LOCALNET>.25.75':445
'<LOCALNET>.25.76':445
'<LOCALNET>.25.77':445
'<LOCALNET>.25.62':445
'<LOCALNET>.25.93':445
'<LOCALNET>.25.80':445
'<LOCALNET>.25.81':445
'<LOCALNET>.25.82':445
'<LOCALNET>.25.83':445
'<LOCALNET>.25.84':445
'<LOCALNET>.25.85':445
'<LOCALNET>.25.86':445
'<LOCALNET>.25.87':445
'<LOCALNET>.25.88':445
'<LOCALNET>.25.89':445
'<LOCALNET>.25.90':445
'<LOCALNET>.25.91':445
'<LOCALNET>.25.92':445
'<LOCALNET>.25.94':445
'<LOCALNET>.25.254':445

Miscellaneous

Creates and executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Backup Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$VEEAMSQL2012 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$VEEAMSQL2008R2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$TPSAMA /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$TPS /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SYSTEM_BGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SHAREPOINT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PROFXENGAGEMENT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PRACTTICEBGC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PRACTICEMGT /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$ECWDB2 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$BKUPEXEC /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSOLAP$SQL_2008 /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Filter Service" /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SBSMONITORING /y' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter /y' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SYSTEM_BGC /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$TPS /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPS /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$TPSAMA /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2012 /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQLSERVER /y
'%WINDIR%\syswow64\net1.exe' stop MSSQLSERVER /y
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLBrowser /y
'%WINDIR%\syswow64\net1.exe' stop SQLBrowser /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SHAREPOINT /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\cmd.exe' /c net stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Filter Service" /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\net1.exe' stop MSOLAP$SQL_2008 /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$BKUPEXEC /y
'%WINDIR%\syswow64\cmd.exe' /c net stop SQLWriter /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$VEEAMSQL2008R2 /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$ECWDB2 /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PRACTTICEBGC /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\net1.exe' stop MSSQL$PROFXENGAGEMENT /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$SBSMONITORING /y
'%WINDIR%\syswow64\net1.exe' stop "SQLsafe Backup Service" /y
'%WINDIR%\syswow64\cmd.exe' /c net stop MSSQL$PRACTICEMGT /y
'%WINDIR%\syswow64\net1.exe' stop SQLWriter /y

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial